fix: address review findings

src/pokemon.rs

@@ -24,6 +24,7 @@ impl PokeApiClient {
 
     #[instrument(skip(self), fields(pokemon.name = %name))]
     pub async fn get_pokemon_info(&self, name: &str) -> Result<PokemonInfo, AppError> {
+        validate_pokemon_name(name)?;
         let url = format!("{}/pokemon-species/{}", self.base_url, name);
         let response = self
             .http
@@ -78,9 +79,9 @@ impl TryFrom<PokemonSpeciesResponse> for PokemonInfo {
         let description = species
             .flavor_text_entries
             .iter()
-            .find(|entry| entry.language.name == "en")
+            .filter(|entry| entry.language.name == "en")
             .map(|entry| normalize_description(&entry.flavor_text))
-            .filter(|description| !description.is_empty())
+            .find(|description| !description.is_empty())
             .ok_or_else(|| {
                 AppError::InvalidUpstreamData("missing English flavor text".to_owned())
             })?;
@@ -96,6 +97,21 @@ impl TryFrom<PokemonSpeciesResponse> for PokemonInfo {
     }
 }
 
+pub fn validate_pokemon_name(name: &str) -> Result<(), AppError> {
+    let is_valid = !name.is_empty()
+        && name
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-');
+
+    if is_valid {
+        Ok(())
+    } else {
+        Err(AppError::BadRequest(
+            "pokemon name must contain only ASCII letters, digits, or hyphens".to_owned(),
+        ))
+    }
+}
+
 #[must_use]
 pub fn normalize_description(description: &str) -> String {
     description.split_whitespace().collect::<Vec<_>>().join(" ")
@@ -115,7 +131,7 @@ fn map_reqwest_error(error: &reqwest::Error) -> AppError {
 
 #[cfg(test)]
 mod tests {
-    use super::{PokeApiClient, normalize_description};
+    use super::{PokeApiClient, normalize_description, validate_pokemon_name};
     use crate::error::AppError;
     use std::time::Duration;
     use wiremock::{Mock, MockServer, ResponseTemplate, matchers};
@@ -127,6 +143,13 @@ mod tests {
         assert_eq!(normalized, "Line one line two line three");
     }
 
+    #[test]
+    fn rejects_names_that_could_change_the_upstream_url_shape() {
+        let error = validate_pokemon_name("foo?bar=baz").expect_err("name should be rejected");
+
+        assert!(matches!(error, AppError::BadRequest(_)));
+    }
+
     #[tokio::test]
     async fn fetches_basic_pokemon_information_from_species_endpoint() {
         let server = MockServer::start().await;
@@ -199,6 +222,32 @@ mod tests {
         assert!(matches!(error, AppError::NotFound));
     }
 
+    #[tokio::test]
+    async fn skips_empty_english_descriptions_until_it_finds_a_non_empty_one() {
+        let server = MockServer::start().await;
+        Mock::given(matchers::method("GET"))
+            .and(matchers::path("/pokemon-species/eevee"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "name": "eevee",
+                "is_legendary": false,
+                "habitat": { "name": "urban" },
+                "flavor_text_entries": [
+                    { "flavor_text": " \n \t", "language": { "name": "en" } },
+                    { "flavor_text": "Can evolve in many ways.", "language": { "name": "en" } }
+                ]
+            })))
+            .mount(&server)
+            .await;
+        let client = client_for(&server);
+
+        let pokemon = client
+            .get_pokemon_info("eevee")
+            .await
+            .expect("second English description should be used");
+
+        assert_eq!(pokemon.description, "Can evolve in many ways.");
+    }
+
     #[tokio::test]
     async fn rejects_species_without_english_description() {
         let server = MockServer::start().await;